The issue is a Cross-Site Request Forgery (CSRF) vulnerability, which allows an attacker to perform actions on a user's behalf without their consent. This is a type of attack where an attacker tricks a user into performing unintended actions on a web application that the user is authenticated to.